Denoising-Aware Inversion Exposes Privacy Risks in Noisy Text Embeddings

Dense text embeddings are widely used for their compact and semantically rich representations, but they pose privacy risks as original text can be inverted from them. A common defense involves adding Gaussian noise to embeddings, which has been considered effective against standard inversion attacks without significantly degrading utility. However, this research investigates the vulnerability of such noise-protected embeddings to adaptive attackers. The study identifies a "Double Noise Trap" that hinders existing generative inversion methods in this noisy setting. To overcome this, the authors propose DAEI (Denoising-Aware Embedding Inversion), a pipeline combining a residual denoising autoencoder with generative text inversion. The denoiser is trained unsupervised using Stein's unbiased risk estimate, allowing it to denoise from noisy observations alone. Experiments show DAEI achieves a 154% relative improvement in BLEU score over baselines, significantly enhancing text reconstruction and demonstrating that simple Gaussian perturbation may not be a sufficient privacy defense.